Anchor Cms
Vendor:
First CVE: Dec 2, 2014 · Active for 11 years
11
Total CVEs
More Total CVEs than 90% of tracked products
1.6
Avg CVEs / Year
Higher CVE frequency than 62% of tracked products
5.8
Avg CVSS
Higher Avg CVSS than 21% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Anchor Cms over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 2, 2014
11 years ago
Most Recent CVE
Jun 9, 2025
413 days ago
CVE Severity & Scoring
Anchor Cms11 CVEs
9%
64%
27%
All CVEs352,785 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local0 (0.0%)
Network9 (81.8%)
Unknown2 (18.2%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low9 (81.8%)
High0 (0.0%)
Unknown2 (18.2%)
User Interaction
None1 (9.1%)
Unknown2 (18.2%)
Required8 (72.7%)
Privileges Required
Low3 (27.3%)
High2 (18.2%)
None4 (36.4%)
Unknown2 (18.2%)
Top CVEs
Signals from CVEs in this product scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-23342HIGH A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users. | Jan 19, 2021 | 8.8 | 44 | NO | YES |
CVE-2025-46041MEDIUM A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript via the page description field in the page creation interfac | Jun 9, 2025 | 5.4 | 28 | NO | YES |
CVE-2024-37732MEDIUM Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file. | Jun 24, 2024 | 6.1 | 24 | NO | NO |
CVE-2024-29499HIGH Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/users/delete/2. | Mar 22, 2024 | 7.4 | 21 | NO | NO |
CVE-2021-44116MEDIUM Cross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php. Attackers can use the posts column to upload the title and content containing malicious code to | Dec 15, 2021 | 6.1 | 21 | NO | NO |
CVE-2015-5687HIGH system/session/drivers/cookie.php in Anchor CMS 0.9.x allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object | Oct 5, 2015 | 7.5 | 20 | NO | NO |
CVE-2022-25576MEDIUM Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php. This vulnerability allows attackers to arbitrarily delet | Mar 24, 2022 | 4.5 | 19 | NO | NO |
CVE-2015-5060MEDIUM Cross-site scripting (XSS) vulnerability in anchor-cms before 0.9-dev. | Sep 7, 2017 | 6.1 | 17 | NO | NO |
CVE-2014-9182MEDIUM models/comment.php in Anchor CMS 0.9.2 and earlier allows remote attackers to inject arbitrary headers into mail messages via a crafted Host: header. | Dec 2, 2014 | 4.3 | 17 | NO | NO |
CVE-2021-46253MEDIUM A cross-site scripting (XSS) vulnerability in the Create Post function of Anchor CMS v0.12.7 allows attackers to execute arbitrary web scripts or HTML. | Feb 1, 2022 | 5.4 | 15 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (11 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
2 CVEs
18.2% of CVEs· 87th percentile
Social Chatter
Signals from CVEs in this product scope (11 CVEs).
Media Mentions
Signals from CVEs in this product scope (11 CVEs).
Top CNAs Publishing CVEs For Anchor Cms
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 0.9.3 | 1 | 7.5 | 2.5% | 0 | 0 |
| 0.9.2 | 1 | 7.5 | 2.5% | 0 | 0 |
| 0.9.1 | 2 | 5.9 | 1.8% | 0 | 0 |
| 0.12.7 | 7 | 5.7 | 4.5% | 0 | 2 |